X-Git-Url: https://git.saurik.com/apple/security.git/blobdiff_plain/80e2389990082500d76eb566d4946be3e786c3ef..d8f41ccd20de16f8ebe2ccc84d47bf1cb2b26bbb:/SecurityTests/clxutils/p12/p12GetPassKey.cpp

diff --git a/SecurityTests/clxutils/p12/p12GetPassKey.cpp b/SecurityTests/clxutils/p12/p12GetPassKey.cpp
new file mode 100644
index 00000000..59ae25c9
--- /dev/null
+++ b/SecurityTests/clxutils/p12/p12GetPassKey.cpp
@@ -0,0 +1,132 @@
+/*
+ * p12GetPassKey.h - get a CSSM_ALGID_SECURE_PASSPHRASE key for encode/decode
+ */
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+#include "p12GetPassKey.h"
+#include <CoreServices.framework/Frameworks/CarbonCore.framework/Headers/MacErrors.h>
+#include <Security/cssmapple.h>
+#include <utilLib/cspwrap.h>
+
+/* when true, simulate secure passphrase in CSPDL */
+#define SIMULATE_PASSPHRASE		1
+
+/* 
+ * Safe gets().
+ * -- guaranteed no buffer overflow
+ * -- guaranteed NULL-terminated string
+ * -- handles empty string (i.e., response is just CR) properly
+ */
+void getString(
+	char *buf,
+	unsigned bufSize)
+{
+	unsigned dex;
+	char c;
+	char *cp = buf;
+	
+	for(dex=0; dex<bufSize-1; dex++) {
+		c = getchar();
+		if (c == EOF) {
+			break;
+		}
+		
+		if(!isprint(c)) {
+			break;
+		}
+		switch(c) {
+			case '\n':
+			case '\r':
+				goto done;
+			default:
+				*cp++ = c;
+		}
+	}
+done:
+	*cp = '\0';
+}
+
+OSStatus p12GetPassKey(
+	CSSM_CSP_HANDLE	cspHand,
+	GPK_Type 		gpkType,
+	bool			isRawCsp,
+	CSSM_KEY		*passKey)		// RETURNED
+{
+	if(isRawCsp || SIMULATE_PASSPHRASE) {
+		char passphrase[512];
+		
+		if(gpkType == GPK_Decode) {
+			printf("Enter passphrase for PKCS12 Decode: ");
+		}
+		else {
+			printf("Enter passphrase for PKCS12 Encode: ");
+		}
+		getString(passphrase, 512);
+		
+		/* cook up a raw key with passphrase as data */
+		unsigned phraseLen = strlen(passphrase);
+		CSSM_KEY		rawKey;
+		memset(&rawKey, 0, sizeof(CSSM_KEY));
+		CSSM_KEYHEADER	&hdr = rawKey.KeyHeader;
+		hdr.HeaderVersion = CSSM_KEYHEADER_VERSION;
+		hdr.BlobType = CSSM_KEYBLOB_RAW;
+		hdr.Format = CSSM_KEYBLOB_RAW_FORMAT_OCTET_STRING;
+		hdr.AlgorithmId = CSSM_ALGID_SECURE_PASSPHRASE;
+		hdr.KeyClass = CSSM_KEYCLASS_SESSION_KEY;
+		hdr.LogicalKeySizeInBits = phraseLen * 2 * 8;
+		hdr.KeyAttr = CSSM_KEYATTR_MODIFIABLE | CSSM_KEYATTR_EXTRACTABLE;
+		hdr.KeyUsage = CSSM_KEYUSE_DERIVE;
+		
+		#if 0
+		/* data = Unicode version of C string passphrase, bigendian */
+		rawKey.KeyData.Length = phraseLen * 2;
+		rawKey.KeyData.Data = (uint8 *)malloc(phraseLen * 2);
+		const char *cpIn = passphrase;
+		char *cpOut = (char *)rawKey.KeyData.Data;
+		
+		for(unsigned dex=0; dex<phraseLen; dex++) {
+			*cpOut++ = 0;
+			*cpOut++ = *cpIn++;
+		}
+		#else
+		
+		/* data = external representation of CFString */
+		CFStringRef cfStr = CFStringCreateWithCString(NULL, passphrase,
+			kCFStringEncodingASCII);
+		CFDataRef cfData = CFStringCreateExternalRepresentation(NULL,
+			cfStr, kCFStringEncodingUnicode, 0);
+		unsigned keyLen = CFDataGetLength(cfData);
+		rawKey.KeyData.Length = keyLen;
+		rawKey.KeyData.Data = (uint8 *)malloc(keyLen);
+		memmove(rawKey.KeyData.Data, CFDataGetBytePtr(cfData), keyLen);
+		CFRelease(cfData);
+		CFRelease(cfStr);
+		hdr.LogicalKeySizeInBits = keyLen * 8;
+		#endif
+		CSSM_DATA descrData = {0, NULL};
+		
+		/* NULL unwrap to make a ref key */
+		CSSM_RETURN crtn = cspUnwrapKey(cspHand,
+			&rawKey,
+			NULL,			// wrappingKey
+			CSSM_ALGID_NONE,
+			0, 0, 0, 		// mode, pad, vector
+			passKey,
+			&descrData,
+			"someLabel",
+			9);				// labelLen 
+		if(crtn) {
+			printf("***Error doing NULL wrap of passKey.\n");
+			return crtn;
+		}
+		return crtn;
+	}
+	else {
+		printf("SS does not support secure passphrase yet.");
+		/*
+		 * TBD: do a DeriveKey
+		 */
+		return unimpErr;
+	}
+}